Asset owners and operators
IEC 62443-2-1 security program across the 8 SPEs · IEC 62443-3-2 risk assessment, zones and conduits, SL-T · IEC 62443-3-3 system requirements as the design basis · IEC 62443-2-4 requirements for your service providers.
Home / Compliance / IEC 62443
Standards · Asset owners, service providers, product suppliers
IEC 62443, implemented the way your plant runs
IEC 62443 is the reference for industrial automation and control system (IACS) security, and the common technical language behind NIS 2, the CRA and ISASecure. We implement it with ISO/IEC 27001 and, where safety functions are involved, with IEC 61511.
8 SPEsORG · CM · NET · COMP · DATA · USER · EVENT · AVAIL (IEC 62443-2-1:2024)
Zones & conduitsRisk-based segmentation (IEC 62443-3-2)
SL-T · SL-C · SL-ATarget, capability and achieved security levels
FR 1–7Foundational requirements behind every system and component requirement
Who owns which part
One series, three roles
Most projects fail at the hand-offs between roles. We work across all three, so the requirements flow from the asset owner's risk assessment to the integrator's design and the supplier's products.
Integrators, EPCs and service providers
IEC 62443-2-4 service-provider capabilities for integration and maintenance · IEC 62443-3-3 system capabilities (SL-C) · cybersecurity deliverables across FEED, detailed design, FAT, SAT and handover.
Product suppliers
IEC 62443-4-1 secure development lifecycle (SM, SR, SD, SI, SVV, DM, SUM, SG) · IEC 62443-4-2 component requirements, rolling up into 3-3 system capabilities and CRA evidence.
Cyber–safety
Where IEC 62443 meets IEC 61511
IEC 61511 requires a security risk assessment of the safety instrumented system (SIS). We carry it out guided by ISA-TR84.00.09, treating cyber as a cause that can defeat protection layers, feed the results into HAZOP and LOPA, and reflect SIS/BPCS independence in the zone design (B3 Cyber–safety alignment).
“Functional safety and cybersecurity aren't analogous: they literally meet inside the same controller.”
One management system
IEC 62443 and ISO/IEC 27001, together
Corporate IT runs on ISO/IEC 27001; the plant needs IEC 62443. We build one Unified Security Management System with a combined Statement of Applicability (IEC 62443-2-1 SPEs + ISO/IEC 27001 Annex A), built from the OT side so the controls work in the control room, and ready for ISO/IEC 27001 and ISASecure ACSSA certification (A1).
Related services
IEC 62443 across the lifecycle
B2
IEC 62443-3-2 risk assessments
System under consideration, zones and conduits, high-level and detailed risk assessment, SL-T and the CRS.
C1Requirements & specifications
IEC 62443-3-3 requirements at your SL-T, as the design basis for EPC and vendor delivery.
C4Assurance & verification
SL verification, cyber FAT and SAT, OT security assessments and penetration testing.
D1Operational posture assessment
Scored per IEC 62443-2-1 SPE and IEC 62443-3-3 FR, with top risks and a 90-day plan.
A5Supply-chain security
IEC 62443-2-4 requirements in tenders and contracts, vendor assessments.
A4ISASecure ACSSA certification
Independent proof that your operating IACS conforms to IEC 62443.
Related training
Starting with IEC 62443, or stuck halfway?
Tell us about your plant and where you are. We will come back with a clear scope and a practical first step.